easyMultiple Choice
CISA Practice Question: During an incident response, the IT team isolates…
During an incident response, the IT team isolates a compromised system from the network. Which of the following is the primary purpose of this action?
⚠ Common exam trap
Watch out — candidates often confuse 'preserving evidence' (a forensic goal) with 'containing the incident' (the immediate operational goal), leading them to choose Option A even though isolation is primarily about stopping the attack, not about evidence handling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To prevent further damage and contain the incident.
Isolating a compromised system from the network (e.g., by disconnecting the Ethernet cable, disabling the switch port, or applying a host-based firewall rule to drop all traffic) immediately stops the system from communicating with other hosts. This containment action prevents the attacker from moving laterally, exfiltrating data, or deploying additional malware, thereby limiting the blast radius and stopping ongoing damage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To preserve evidence for forensic analysis.
Why it's wrong here
Isolation prevents further damage or spread; evidence preservation is achieved by imaging memory and disk, not by network disconnection. It is tempting because isolation does incidentally reduce tampering, and would be correct if the question asked how to prevent remote alteration of evidence during collection.
- ✗
To allow the system to be patched offline.
Why it's wrong here
Isolation stops the compromised host communicating with other systems; patching is remediation performed later, often after imaging. It is tempting because offline patching is a genuine recovery step, and would be correct if the question asked how to remediate the vulnerability once containment was complete.
- ✗
To comply with regulatory requirements.
Why it's wrong here
Isolation's primary aim is containing the incident to prevent lateral spread or data exfiltration; regulatory compliance is a secondary outcome, not the driver. It is tempting because breach notification and reporting duties do exist, and isolation would be correct if the question asked how to meet containment-related compliance obligations.
- ✓
To prevent further damage and contain the incident.
Why this is correct
Isolation severs the compromised host's network connectivity, halting lateral movement and data exfiltration to other systems. This directly satisfies the containment objective of incident response: limiting the incident's scope and blast radius before eradication and recovery begin, preserving evidence while preventing the attacker from causing additional harm.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.